CVE-2025-32910: libsoup NULL Pointer DOS Vulnerability

CVE-2025-32910 Overview

A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash, resulting in a denial of service condition. The vulnerability affects applications that utilize the libsoup HTTP client library for digest authentication operations.

Critical Impact

Applications using libsoup for HTTP digest authentication may experience unexpected crashes when processing malformed authentication responses, potentially leading to denial of service conditions.

Affected Products

• libsoup (HTTP client/server library for GNOME)
• Applications utilizing libsoup for HTTP operations
• Linux distributions including Red Hat Enterprise Linux and Debian

Discovery Timeline

• 2025-04-14 - CVE-2025-32910 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-32910

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw exists within the soup_auth_digest_authenticate() function in the libsoup library. When this function processes authentication data under certain conditions, it may attempt to dereference a NULL pointer, causing the application to crash.

libsoup is a widely-used HTTP client/server library in the GNOME ecosystem, making this vulnerability relevant to numerous Linux applications that rely on it for network operations. The attack requires network access and user interaction, as the vulnerable function is triggered during HTTP digest authentication flows.

The vulnerability can be exploited remotely by an attacker who can influence the authentication response received by a libsoup client. When the client processes a specially crafted or malformed response during digest authentication, the NULL pointer dereference is triggered, leading to an immediate application crash.

Root Cause

The root cause of this vulnerability is improper validation of pointer values before dereferencing within the soup_auth_digest_authenticate() function. The code fails to verify that required data structures are properly initialized before accessing their members, leading to a NULL pointer dereference when unexpected input conditions occur.

Attack Vector

The attack vector for CVE-2025-32910 is network-based. An attacker can exploit this vulnerability by setting up a malicious server or performing a man-in-the-middle attack to deliver crafted HTTP digest authentication responses to a vulnerable libsoup client. When the client attempts to process the authentication data, the NULL pointer dereference occurs, causing the application to crash.

The vulnerability is triggered when:

1. A libsoup client initiates an HTTP request to a server requiring digest authentication
2. The server (or attacker) responds with a malformed authentication challenge
3. The soup_auth_digest_authenticate() function processes the response
4. A NULL pointer is dereferenced due to missing validation

Detection Methods for CVE-2025-32910

Indicators of Compromise

• Unexpected application crashes in programs using libsoup for HTTP operations
• Core dumps or crash logs referencing soup_auth_digest_authenticate() function
• Abnormal network traffic patterns with malformed HTTP authentication headers
• Repeated segmentation faults in applications performing HTTP digest authentication

Detection Strategies

• Monitor system logs for segmentation faults or SIGSEGV signals in applications linked against libsoup
• Implement network monitoring to detect unusual HTTP authentication challenge responses
• Review application crash reports for NULL pointer dereference patterns in libsoup functions
• Use SentinelOne's real-time monitoring capabilities to detect exploitation attempts targeting this vulnerability

Monitoring Recommendations

• Enable core dump collection for applications using libsoup to capture crash forensics
• Configure application-level logging to track HTTP authentication attempts and failures
• Deploy network intrusion detection rules to identify malformed HTTP authentication traffic
• Utilize SentinelOne Singularity platform for comprehensive endpoint monitoring and threat detection

How to Mitigate CVE-2025-32910

Immediate Actions Required

• Update libsoup to the latest patched version available for your distribution
• Review applications using libsoup and prioritize patching for internet-facing services
• Consider implementing additional network security controls to limit exposure to untrusted servers
• Monitor for application crashes that may indicate exploitation attempts

Patch Information

Security patches are available from major Linux distributions. Refer to the following advisories for patching guidance:

• Red Hat Security Advisory RHSA-2025:8292
• Red Hat CVE-2025-32910 Details
• Red Hat Bug Report #2359354
• Debian LTS Announcement April 2025

Workarounds

• If patching is not immediately possible, consider restricting network access for applications using libsoup
• Implement network-level filtering to prevent connections to untrusted servers requiring digest authentication
• Deploy application sandboxing to limit the impact of potential crashes
• Use alternative authentication methods where feasible to avoid triggering the vulnerable code path

# Check installed libsoup version on Red Hat-based systems
rpm -qa | grep libsoup

# Check installed libsoup version on Debian-based systems
dpkg -l | grep libsoup

# Update libsoup on Red Hat-based systems
sudo dnf update libsoup

# Update libsoup on Debian-based systems
sudo apt update && sudo apt upgrade libsoup*